CVE-2013-4535: The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute...

Security readout for executives and security teams

This old QEMU issue affects versions before 1.7.2. A malicious VM save image could abuse virtio handling and cause execution of arbitrary files. Business risk is highest where teams restore, migrate, or import VM save images from untrusted or weakly controlled sources. Exposure is likely limited to environments still running QEMU before 1.7.2 and accepting, restoring, or processing crafted savevm images. Modern packaged QEMU deployments are less likely affected, but legacy virtualization hosts and old appliance stacks should be checked. Treat this as a legacy virtualization exposure. It is not documented as actively exploited in the supplied sources, but affected hosts handling untrusted VM state files could face host-level impact. Prioritize legacy host inventory and upgrade confirmation. Mitigation focus: Upgrade QEMU to 1.7.2 or later, or a vendor-fixed package.; Review Red Hat and Fedora advisories for distribution-specific fixed builds.; Do not restore VM save images from untrusted sources..

Prepared

Jun 6, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.